Trigger real time alert once

[samiomer]

Hello,

I was wondering how I can make Splunk notify me of an alert in real time only once. For example, if I'm running a real time search for when a firewall is turned off, how do I keep Splunk from alerting me for the same results repeatedly (which looks like it happens 3 to 4 times a minute)?

Thanks

[tommasog]

Only 4.3 supports "once per event".
Anyone found a fully working work-around for 4.2.2?

[kristian_kolb]

rpm -Uvh splunk-4.3-115073-linux-2.6-x86_64.rpm

😉

There are a few performance and security issues that are solved as well when upgrading.

/k

[elenzil]

my understanding of throttling is that it's not the same as alerting once per event.

eg, if i have throttling set to no more than once per minute,
and an event occurs twice, in two consecutive seconds,
i want to get exactly two alerts.

i'm still looking for an answer to the poster's question.

[dijikul]

Did this ever get resolved? I'm looking for this same thing now, 7 years later... Is this built in?

[MuS · Accepted solution]

hi samiomer

Alert throttling can be setup like written in the docs or for pre 4.2 splunk with the app alert throttle.

regards

[samiomer]

Thanks. That helped 🙂